[Stanley]

Microsoft Warns of ‘Payroll Pirates’ Hijacking HR SaaS Accounts to Steal Employe

A threat actor known as Storm-2657 has been observed hijacking employee accounts with the end goal of diverting salary payments to attacker-controlled accounts.
"Storm-2657 is actively targeting a range of U.S.-based organizations, particularly employees in sectors like higher education, to gain access to third-party human resources (HR) software as a service (SaaS) platforms like Workday," the

https://thehackernews.com/2025/10/micros...rates.html

[Mix]

Interesting aproach to such a easy to detect action. I know a friend of mine has workday at there job so will hope the best for them to not be targeted.

[Vectura]

That’s wild but not really shocking. HR platforms are basically treasure chests for attackers, personal data, payroll info, everything in one place. Companies really need to stop treating SaaS security like an afterthought.

[Mix]

That’s wild but not really shocking. HR platforms are basically treasure chests for attackers, personal data, payroll info, everything in one place. Companies really need to stop treating SaaS security like an afterthought.

I find it funny when companys think they dont need to worry about paying for a secrue HR system. 🤣

[Oh_Well]

HRs are most of the times easy targets, those guys have no idea about tech

[Chorozon]

Most of the new SaaS admins are vibe coders so i can see this becoming more of a thing

[Rsynced]

Well this is a new phrase I just learned today "Payroll Pirates"🤦‍♂️

[DAL-SHA]

Wow !! Even HR platforms are now prime targets for smart attackers.
Some one has a history with HR Departments !! 🤣🤣

[Mix]

Wow !! Even HR platforms are now prime targets for smart attackers.
Some one has a history with HR Departments !! 🤣🤣

They have always been a target but now with AI snooping around to find ways around it all it hasnt been easier.

[Eran]

Wow !! Even HR platforms are now prime targets for smart attackers.
Some one has a history with HR Departments !! 🤣🤣

HR platforms are one of the easiest to attack imho.

[DAL-SHA]

HR platforms are one of the easiest to attack imho.

Just because they contain a lot of info about the company workers or private info you think ??? 🕵️🕵️

[Hackers]

This makes sense, manager comps get infected & then used to send payments out for whatever funds that user has access to.

You could also trigger change requests that look innocent enough for another supervisor to approve i guess?

[leste]

Interesting that they're targeting employees in the higher education sector.